VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Mar 5, 2024· Updated Apr 15, 2026

CVE-2024-24785

CVE-2024-24785

Description

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

If errors returned from MarshalJSON methods contain user-controlled data, they may break html/template's contextual auto-escaping, enabling template injection.

Vulnerability

CVE-2024-24785 is a security issue in Go's html/template package. When a type implements MarshalJSON and the method returns an error, the error message is inserted into a template comment. The package replaces comment-closing tokens (*/) with * / to prevent comment breakage, but it does not handle script-closing tags (</script) or HTML comment-open tags (<!--). If the error contains user-controlled data, an attacker can craft input that includes these tags to break out of the comment context and inject arbitrary content.

Exploitation

The vulnerability can be exploited when a template action involves a value whose MarshalJSON method fails with a user-controlled error string. An attacker with the ability to influence template data (e.g., via form input, URL parameters, or other untrusted sources) can supply malicious content that, when the error is generated, produces a string containing ` or <!--`. This string is inserted into a comment, but because the escaping is incomplete, it can close the comment and inject HTML or JavaScript into the resulting page. No special authentication is required beyond the ability to provide template data.

Impact

Successful exploitation allows an attacker to bypass the contextual auto-escaping of html/template, leading to cross-site scripting (XSS) or other content injection attacks. This can result in session theft, defacement, or execution of arbitrary scripts in the context of the victim's browser. The severity is medium (CVSS 5.4) because exploitation requires some control over error messages.

Mitigation

The issue was fixed in Go 1.22.1 and Go 1.21.8. Users are advised to update their Go toolchain to these versions or later [2]. The fix ensures that in the script context, tags like </script and <!-- are appropriately escaped using \x3C/script and \x3C!-- to prevent breakout [4]. No workaround is available; updating is the recommended course of action.

References
  1. [security] Go 1.22.1 and Go 1.21.8 are released
  2. html/template: errors returned from MarshalJSON are not correctly escaped

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

1398

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.